Details of VAR-201810-1623

ID

VAR-201810-1623

CVE

CVE-2018-25358

TITLE

D-Link DIR601 Credential Disclosure Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2018-20852

DESCRIPTION

D-Link DIR601 2.02NA contains a credential disclosure vulnerability that allows unauthenticated attackers to retrieve sensitive configuration data by manipulating the table_name parameter in POST requests. Attackers can send requests to /my_cgi.cgi with table_name values like admin_user, wireless_settings, and wireless_security to extract administrative credentials and wireless network keys in clear text. D-LinkDIR-601 is a popular 150M household product. D-LinkDIR601 has a certificate disclosure vulnerability

Trust: 1.44

sources: NVD: CVE-2018-25358 // CNVD: CNVD-2018-20852

IOT TAXONOMY

category:

['ICS', 'Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2018-20852

AFFECTED PRODUCTS

vendor:

d link

model:

dir601

scope:

version:

2.02

Trust: 0.6

sources: CNVD: CNVD-2018-20852

CVSS

SEVERITY

CVSSV2

CVSSV3

disclosure@vulncheck.com:	CVE-2018-25358
value:	HIGH
Trust: 1.0
CNVD:	CNVD-2018-20852
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2018-20852
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

disclosure@vulncheck.com:	CVE-2018-25358
baseSeverity:	HIGH
baseScore:	7.5
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	3.9
impactScore:	3.6
version:	3.1
Trust: 1.0

sources: CNVD: CNVD-2018-20852 // NVD: CVE-2018-25358

PROBLEMTYPE DATA

problemtype:

CWE-497

Trust: 1.0

sources: NVD: CVE-2018-25358

EXTERNAL IDS

db:	EXPLOIT-DB	id:	45002	Trust: 1.6
db:	NVD	id:	CVE-2018-25358	Trust: 1.0
db:	EXPLOITDB	id:	45002	Trust: 0.6
db:	CNVD	id:	CNVD-2018-20852	Trust: 0.6

sources: CNVD: CNVD-2018-20852 // NVD: CVE-2018-25358

REFERENCES

url:	http://support.dlink.ca/productinfo.aspx?m=dir-601	Trust: 1.0
url:	https://www.packetlabs.net	Trust: 1.0
url:	http://ca.dlink.com/	Trust: 1.0
url:	https://www.vulncheck.com/advisories/d-link-dir601-2-02na-credential-disclosure-via-my-cgi-cgi	Trust: 1.0
url:	https://www.exploit-db.com/exploits/45002	Trust: 1.0
url:	https://www.exploit-db.com/exploits/45002/	Trust: 0.6

sources: CNVD: CNVD-2018-20852 // NVD: CVE-2018-25358

SOURCES

db:	CNVD	id:	CNVD-2018-20852
db:	NVD	id:	CVE-2018-25358

LAST UPDATE DATE

2026-07-24T22:58:39.133000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-20852	date:	2018-10-12T00:00:00
db:	NVD	id:	CVE-2018-25358	date:	2026-07-23T17:10:00.123

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2018-20852	date:	2018-10-12T00:00:00
db:	NVD	id:	CVE-2018-25358	date:	2026-05-23T19:16:56.167